CVE-2024-9061
CriticalWP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add
Published Oct 17, 2024 · Updated Apr 8, 2026 · Also known as 0cac1dc0-87dc-43eb-9db1-638a91200b43
Key Facts
Patch immediately- CVE-2024-9061 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Wp Popup Builder (Themehunk), WP Popup Builder – Popup Forms and Marketing Lead Generation.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 52% probability of exploitation in the next 30 days.
- Fixed versions are available, including Wp Popup Builder 1.3.6.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
52%
Higher than 98.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2024-9061 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. NOTE: This vulnerability was partially fixed in version 1.3.5 with a nonce check, which effectively prevented access to the affected function. However, version 1.3.6 incorporates the correct authorization check to prevent unauthorized access.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Wp Popup BuilderThemehunk | See advisory | 1.3.6 |
| WP Popup Builder – Popup Forms and Marketing Lead Generation | See advisory | n/a |
Patched Releases
Wp Popup Builder
1.3.6
Timeline
Publicly disclosed
Oct 17, 2024
Last updated
Apr 8, 2026
Weakness Type
- CWE-94 Improper Control of Generation of Code ('Code Injection')
References
- advisoryhttps://wordpress.org/plugins/nmedia-user-file-uploader/#developers
- advisoryhttps://wpscan.com/vulnerability/052f7d9a-aaff-4fb1-92b7-aeb83cc705a7
- advisoryhttps://www.acunetix.com/vulnerabilities/web/wordpress-plugin-n-media-post-front-end-form-arbitrary-file-upload-1-0/
- advisoryhttps://www.pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-front-end-file-upload-and-manager-plugin/
- advisoryhttps://www.pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-n-media-post-front-end-form/
FAQ
Common Questions.
The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to, and including, 1.3.5.
Affected: Wp Popup Builder (Themehunk); WP Popup Builder – Popup Forms and Marketing Lead Generation. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Wp Popup Builder 1.3.6.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2024-9061 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo